ABSTRACT OF THE DISCLOSURE 



Methods and apparatus for collecting, storing, 
processing and using data, such a RM0N2 network traffic 
data, are described. Network traffic probes are 
identified and attempts are made to configure the 
identified probes to generate network traffic data sets 
which are as close to a preselected common data format as 
possible. Application layer traffic data is collected in 
addition to network layer traffic data when possible. In 
an RM0N2 embodiment, the common data format includes the 
use of delta count values as opposed to absolute count 
values. The common data format of the present invention 
utilizes terminal count mode format as opposed to all 
count mode format for the presentation of RM0N2 
application layer information. To minimize the amount of 
data processing required to put a probe's network traffic 
data into the desired common format and to maximize the 
amount of information collected, network data is obtained 
from a probe using one of the available RM0N2 table 
formats. The utilized format is selected in the 
following order of preference: alMatrixTopN (Terminal 
Mode), alMatrixTopN (AllMode) , alMatrix, nlMatrixTopN and 
nlMatrix. In order to avoid various problems with known 
data aging processes used to limit the growth of network 
traffic databases, a database of collected network 
traffic information which includes multiple parallel sets 
of data stored at different resolutions is created and 
maintained. The data sets for each individual resolution 
are stored in a separate FIFO data structure and with the 
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ldest data records in the FIFO being overwritten when 
llocated data space becomes fully utilized. 



